keybase / keybase/keybase-issues
The Keybase web verification is absolutely broken and does not handle redirects.
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
It seems that keybase wants a 200 response to a HTTP(S) request in order to prove that a host is up.
Instead, my host returns a 301 redirect on HTTP requests - a redirect to HTTPS.
This a very real-world scenario and is completely in line with the current web standards. It appears that Keybase does not follow the web standards, but instead uses a very hacky mechanism to check for whether a website is online.
In addition, the error message Keybase gives when a web verification fails is extremely vague. One cannot tell the difference of "I am not going to return true because I hate you" and "There is a problem with the website's certificate".
On attempt to verify my website by the CLI, I get a
```
error: Failed to find a connection to www.michael.yoo.id.au (error #229)
```
This is not only me, but many, many others who are reporting the same issue:
https://github.com/keybase/keybase-issues/issues/962
https://github.com/keybase/keybase-issues/issues/677
The web interface has the same issue.
Keybase must change it's mechanism for checking whether a website is online. The current system is broken and does not cover all scenarios. Keybase should also follow redirect headers, and output a better error message for the users to better understand whether the problem is of their own fault, or is a bug.
---
/end wall of text
But seriously, can you fix this bug and use better error messages? Thanks!
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the reported failure through both the CLI and web interface using an HTTP request that returns a 301 redirect to HTTPS, and compare it with the error #229 output. Review the related issues for expected behavior; done should include redirect handling and error messages that distinguish certificate, connection, and verification failures.
Written by the indexing model from the issue text.
Assessment
- Domain
- cli, security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100